CVE-2025-24805: Local Privilege Escalation in MobSF

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-02-05 · updated 2026-06-17
Weakness: CWE-269

Description

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework. A local user with minimal privileges is able to make use of an access token for materials for scopes which it should not be accepted. This issue has been addressed in version 4.3.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products

MobSF Mobile-Security-Framework-MobSF: before 4.3.1 — fixed in 4.3.1

How to fix

Upgrade to a fixed version: MobSF Mobile-Security-Framework-MobSF 4.3.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-24805 or the next vulnerability affects your stack